First of all hello to everybody, I am new User here!
Nice to meet you all!I own WWW (Apache), Mail (Postfix, Dovecot) server on CentOS. This server is behind Router connected to ISP with service of Dynamic IP. This is a problem for Mail server, because there is no possibility to set revDNS. I also own very cheap VPS with Static IP and revDNS. This VPS is very weak, so I would like to connect my WWW, Mail server via OpenVPN. On VPS there is OpenVPN server and on the WWW, Mail server side there is OpenVPN client. I have configured and connected it without problems. I can ping outside world from WWW, Mail server, but when I try to open via browser any of my site on Apache, I have an information, that Connection was refused by server and any of my site isn't opening. Below I will present my OpenVPN server.conf and client.conf, and also Iptables rules from VPS and WWW, Mail server, maybe someone will see something is wrong or missing. I would be glad for any help and support.
I. VPS with Static IP, revDNS:
- Static IP: XXX.XXX.XXX.XXX
- Interface: eth0 with inet XXX.XXX.XXX.XXX/32
- Interface: tun0 with inet 10.8.0.1/24
- OpenVPN - server.conf:
Code: Select all
port 1194
proto udp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh /etc/openvpn/server/dhparam.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
tls-auth /etc/openvpn/server/ta.key 0
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status /etc/openvpn/openvpn-status.log
verb 3
explicit-exit-notify 1Code: Select all
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -j DROP
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
COMMIT- Dynamic IP form ISP on router: YYY.YYY.YYY.YYY
- Local IP of WWW, Mail server (behind router): 192.168.50.10
- Interface: enp2s0 with inet 192.168.50.10/24
- Interface: tun0 with inet 10.8.0.2/24 (when connection is made from OpenVPN client)
- Apache listens on 80, 443.
- OpenVPN - client.conf:
Code: Select all
client
dev tun
proto udp
remote XXX.XXX.XXX.XXX 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca /etc/openvpn/client/ca.crt
cert /etc/openvpn/client/client.crt
key /etc/openvpn/client/client.key
remote-cert-tls server
tls-auth /etc/openvpn/client/ta.key 1
cipher AES-256-CBC
verb 3Code: Select all
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -j DROP
COMMIT